Knowing that its a very very old thread, still at this hour we are stuck with the same issue. So we are trying to send the data from Splunk heavy forwarder to a third party destination and the connectivity looks fine but the outputs, props & transforms config that we have done does not seem to be working. I need an urgent help at this case if somebody can ??? This is how our config looks like now: outputs.conf: [tcpout] defaultGroup = nothing disabled = false   [tcpout:datab] server = x.x.x.x:xxxx sendCookedData = false compressed = false   props.conf [host::x.x.x.x] TRANSFORMS-x.x.x.x = route_datab #SHOULD_LINEMERGE = false     transforms.conf [route_datab] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = datab ... View more

I am really hoping to get some answers! ... View more

what if i want to get the difference between _indextime & start_time, i am trying with this : tostring(strftime(_indextime, "%Y/%m/%d %H:%M:%S") - strptime(start_time, "%Y/%m/%d %H:%M:%S"), "duration") but getting error like- Encountered the following error while trying to save: Operator requires numeric types My search is: index=xxx_xxx_firewall sourcetype IN(xxx:xxxxx, xxx:xxxxx) | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | eval it = strptime(start_time, "%Y/%m/%d %H:%M:%S") | eval ot = strptime(receive_time, "%Y/%m/%d %H:%M:%S") | eval diff = tostring((ot - it), "duration") | table start_time, receive_time,indextime,_time, diff   Can you please help if you have some insights on this. ... View more

I want to filter the palo logs at the forwarder level by looking at the packet before indexing( licensing) based certain condition like... zone, firewall name(enterprise) etc The logs comes to both our UF & HF, what is the best way to achieve it. Was looking into a few doc suggesting to apply ingest eval, is that feasible? Can anyone please help me with this. ... View more